What you need to set up phone payments

To take credit card payments over the phone, you need three things: a merchant account (a bank relationship that lets you process card transactions), a payment processor or gateway that handles the actual charge, and a way to securely enter or read the card details. You do not need a physical card reader — the processor converts your phone call into a transaction the same way a website does.

The merchant account comes from your bank or a third-party processor. Your bank may offer one as part of your business checking account, or you may open one separately. The processor is the company that actually moves the money — examples include Square, Stripe, PayPal, Authorize.net, and Worldpay. Some processors handle both the merchant account and the payment gateway themselves, so you deal with one company instead of two.

You will also need a way to enter the card number safely. This means either a virtual terminal (a web page where you type the number), a phone-based system that reads the number to you and encrypts it, or a payment link you send to the customer so they enter it themselves. Never write down a card number or store it after the transaction — that creates liability and violates payment card industry rules.

Key Takeaways

  • A merchant account and payment processor are separate things; your bank provides one, and a company like Square or Stripe provides the other, though some processors combine both.
  • Virtual terminals let you type card details into a secure web page; payment links let the customer enter their own details, which is safer for you.
  • Phone payments cost more per transaction than in-person or online payments because the processor charges a higher rate for the higher fraud risk.
  • You must never store, write down, or reuse a card number after the transaction ends, even if the customer asks you to.
  • Refunds take the same number of business days to reach the customer's account as the original charge took to process.

Virtual terminals vs. payment links

A virtual terminal is a web page you log into with your processor account. You enter the customer's card number, expiration date, and CVV (the three-digit code on the back), then submit the charge. The processor encrypts the data before it reaches your screen, so you never actually see the full number. Virtual terminals work well when you are taking payment from someone who is calling you and reading their card details aloud.

A payment link is a URL you send to the customer via text, email, or messaging app. The customer clicks the link, enters their own card details on a secure page hosted by your processor, and completes the payment. You never touch the card number at all. Payment links are slower (the customer has to receive the link and act on it) but safer for you because you have no access to the card data. Many processors now prefer payment links for phone transactions because they reduce your liability if the card is later reported as fraudulent.

Some processors offer both options. Square, for example, provides a virtual terminal through its dashboard and also lets you generate payment links. Stripe offers payment links and a terminal interface. PayPal has both a virtual terminal and invoice links. Choose based on how quickly you need the money and how much you want to handle the card details yourself.

How phone payment fees work

Phone payments cost more than online or in-person payments because the processor sees them as higher risk. When you swipe a card in person, the processor knows the card is physically present. When a customer enters their own details on a website, the processor can verify the address and CVV. When you read a card number over the phone, the processor has no way to confirm the cardholder is actually the person on the call.

Fees for phone transactions typically run 2.5% to 3.5% of the transaction amount, plus a flat fee of 20 to 50 cents per transaction. In-person payments usually cost 1.5% to 2.3% plus the same flat fee. Online payments fall somewhere in between. The exact rate depends on your processor, your industry, your monthly volume, and your processing history. A processor will quote you a specific rate when you open an account.

Some processors charge the same rate for phone and online payments if you use a payment link instead of a virtual terminal, because the customer enters their own details. Others charge the same rate regardless of method. Ask your processor for their phone payment rate before you sign up, and ask whether the rate changes if you use a payment link instead of reading the card yourself.

Processing time and when the money arrives

A phone payment processes in real time — the charge goes through immediately, and you see the transaction in your processor account within seconds. However, the money does not arrive in your bank account on the same day. Most processors deposit funds the next business day, though some take two to three business days depending on when you process the charge and whether it is a weekend or holiday.

The customer's card is charged immediately, but the charge may not appear on their statement for one to three business days. If the customer calls their bank to dispute the charge during that window, the bank will see a pending transaction. Once the transaction settles (usually within one to three days), it becomes permanent and harder to reverse.

If you need to refund a phone payment, the refund goes back to the customer's card account in the same number of business days it took for the original charge to process. A refund issued on a Monday may take until Wednesday or Thursday to appear, depending on the customer's bank. The customer will see the refund as a credit, not as a reversal of the original charge.

Security and PCI compliance

When you take a card payment over the phone, you are bound by the Payment Card Industry Data Security Standard (PCI DSS). This is a set of rules that protects cardholders from fraud and theft. The core rule is simple: never store, write down, or reuse a card number after the transaction is complete.

If you use a virtual terminal, the processor encrypts the card number before it reaches your computer, so you should never see the full number. If you read the number aloud from the customer, do not write it down or repeat it back. If you use a payment link, you never see the number at all. After the transaction processes, the card details are deleted from the processor's system (usually within 24 hours), and you have no way to retrieve them.

If a customer asks you to keep their card on file so you can charge them again later, you must store it through your processor's tokenization system, not on your own computer or in a spreadsheet. Tokenization means the processor stores the card and gives you a token (a random string of characters) that you can use to charge the card again without ever seeing the number. Only certain processors offer this, and it requires additional PCI compliance steps. Ask your processor whether they support tokenization before you agree to store a card.

Handling disputes and chargebacks

When a customer disputes a phone payment with their bank, the bank calls it a chargeback. The customer claims they did not authorize the charge, the card was fraudulent, or the product or service was not delivered. The processor removes the money from your account and returns it to the customer while the dispute is investigated.

To fight a chargeback, you need proof that the customer authorized the payment. For a phone transaction, this means a recording of the call (if your state allows one-party consent recording), a written confirmation email you sent to the customer after the call, or a signed receipt. Many processors ask you to upload this evidence within 7 to 10 days of the chargeback notice. If you provide strong evidence, the processor may reverse the chargeback and return the money to you. If you do not respond or your evidence is weak, you lose the money and pay a chargeback fee (usually $15 to $100).

Phone payments have higher chargeback rates than in-person or online payments because there is no physical card or customer signature to prove authorization. Some processors will not process phone payments at all, or they will charge you a higher rate and require you to maintain detailed records of every call. If chargebacks are a concern for your business, ask your processor what documentation they require and whether they offer chargeback protection insurance.

Choosing a processor for phone payments

Not all payment processors accept phone payments, and those that do have different rules and rates. Square, Stripe, PayPal, Authorize.net, and Worldpay all offer phone payment options, but they differ in setup time, fees, and the tools they provide.

Square's virtual terminal is free to set up and charges 2.6% plus 10 cents per transaction for phone payments. Stripe's payment links charge 2.9% plus 30 cents. PayPal's virtual terminal charges 2.7% plus 30 cents. Authorize.net charges a monthly gateway fee (around $25) plus per-transaction fees that vary by plan. Worldpay is geared toward larger businesses and requires a sales conversation before you can sign up.

For a small business taking occasional phone payments, Square or PayPal are usually the simplest choice because they have no monthly fees and you can start processing within hours. For a business taking many phone payments, Authorize.net or a dedicated merchant services company may be cheaper because the monthly fee is offset by lower per-transaction rates. Compare the total cost for your expected monthly volume before you choose.

Frequently Asked Questions

Can I record a phone call to prove the customer authorized the payment?

It depends on your state. Some states require both parties to consent to recording; others require only one party to know. If you live in a two-party consent state and record without the customer's permission, the recording is not legal evidence and may expose you to liability. Tell the customer you are recording before you take their card details, and document their consent in writing or in a follow-up email.

What happens if a customer gives me a card number and then claims they never authorized it?

The customer can file a chargeback with their bank, and the bank will investigate. If you have a recording, email confirmation, or signed receipt showing the customer authorized the charge, you can submit that as evidence. If you have no documentation, you will likely lose the chargeback and the money. Always send a confirmation email after a phone payment that includes the amount, the last four digits of the card, and the date.

Can I charge a customer's card again next month without asking them?

Only if they explicitly agreed to recurring charges and you have documented that agreement in writing. If you charge without permission, the customer can dispute it as an unauthorized transaction. If you want to set up recurring payments, use your processor's subscription or recurring billing feature, which sends the customer a reminder before each charge and makes it easy for them to cancel.

How long do I have to keep records of phone payments?

Keep records for at least one year, and longer if your processor or your industry requires it. Records should include the date, the amount, the last four digits of the card, the customer's name, and any confirmation you sent them. If a chargeback is filed, you may need these records to defend yourself, and the bank may request them months after the transaction.

What if my processor declines a phone payment?

The processor's system flagged the transaction as potentially fraudulent based on the card details, the amount, or your account history. Ask the customer to verify their address and the CVV matches their card. If the customer confirms the details are correct, ask your processor why the charge was declined — it may be a fraud filter you can adjust, or it may be a sign the card is stolen. Never process the same charge twice if it is declined the first time.